Skip to content

Commit 43b9436

Browse files
smowtonsmowton
committed
Convert Apache misc text models to CSV taint-flow specifications
1 parent 0029d3b commit 43b9436

File tree

1 file changed

+144
-114
lines changed
  • java/ql/src/semmle/code/java/frameworks/apache

1 file changed

+144
-114
lines changed

‎java/ql/src/semmle/code/java/frameworks/apache/Lang.qll

Lines changed: 144 additions & 114 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
import java
44
private import semmle.code.java.dataflow.FlowSteps
5+
private import semmle.code.java.dataflow.ExternalFlow
56

67
/**
78
* The class `org.apache.commons.lang.RandomStringUtils` or `org.apache.commons.lang3.RandomStringUtils`.
@@ -212,137 +213,166 @@ private class ApacheStrBuilderTaintWriter extends ApacheStrBuilderCallable, Tain
212213
}
213214
}
214215

215-
private class ApacheWordUtilsTaintPreservingMethod extends TaintPreservingCallable {
216-
ApacheWordUtilsTaintPreservingMethod() {
217-
this.getDeclaringType()
218-
.hasQualifiedName(["org.apache.commons.lang3.text", "org.apache.commons.text"], "WordUtils") and
219-
this.getReturnType() instanceof TypeString
220-
}
221-
222-
override predicate returnsTaintFrom(int arg) {
223-
this.getParameterType(arg) instanceof TypeString and
224-
arg != 4 // Exclude the wrapOn parameter from `wrap(String, int, String, boolean, String)`
225-
}
226-
}
227-
228-
private class ApacheStrTokenizer extends RefType {
229-
ApacheStrTokenizer() {
230-
this.hasQualifiedName(["org.apache.commons.lang3.text", "org.apache.commons.text"],
231-
"StrTokenizer") or
232-
this.hasQualifiedName("org.apache.commons.text", "StringTokenizer")
233-
}
234-
}
235-
236216
/**
237-
* A callable that sets the string to be tokenized by an Apache Commons `Str[ing]Tokenizer`.
238-
*
239-
* Note `reset` is an instance method that taints an existing instance; all others return a fresh instance.
217+
* Taint-propagating models for `WordUtils`.
240218
*/
241-
private class ApacheStrTokenizerTaintingMethod extends TaintPreservingCallable {
242-
ApacheStrTokenizerTaintingMethod() {
243-
this.getDeclaringType() instanceof ApacheStrTokenizer and
244-
(
245-
this instanceof Constructor or
246-
this.getName() in ["getCSVInstance", "getTSVInstance", "reset"]
247-
)
248-
}
249-
250-
override predicate returnsTaintFrom(int arg) { arg = 0 }
251-
252-
override predicate transfersTaint(int fromArg, int toArg) {
253-
this.getName() = "reset" and
254-
returnsTaintFrom(fromArg) and
255-
toArg = -1
256-
}
257-
}
258-
259-
private class ApacheStrTokenizerTaintGetter extends TaintPreservingCallable {
260-
ApacheStrTokenizerTaintGetter() {
261-
this.getDeclaringType() instanceof ApacheStrTokenizer and
262-
this.getName() in [
263-
"getContent", "getTokenArray", "getTokenList", "nextToken", "previousToken", "toString"
219+
private class ApacheWordUtilsModel extends SummaryModelCsv {
220+
override predicate row(string row) {
221+
row =
222+
[
223+
"org.apache.commons.lang3.text;WordUtils;false;wrap;;;Argument[0];ReturnValue;taint",
224+
"org.apache.commons.lang3.text;WordUtils;false;wrap;(java.lang.String,int,java.lang.String,boolean);;Argument[2];ReturnValue;taint",
225+
"org.apache.commons.lang3.text;WordUtils;false;wrap;(java.lang.String,int,java.lang.String,boolean,java.lang.String);;Argument[2];ReturnValue;taint",
226+
"org.apache.commons.lang3.text;WordUtils;false;uncapitalize;(java.lang.String);;Argument;ReturnValue;taint",
227+
"org.apache.commons.lang3.text;WordUtils;false;uncapitalize;(java.lang.String,char[]);;Argument[0];ReturnValue;taint",
228+
"org.apache.commons.lang3.text;WordUtils;false;swapCase;;;Argument;ReturnValue;taint",
229+
"org.apache.commons.lang3.text;WordUtils;false;capitalize;(java.lang.String);;Argument;ReturnValue;taint",
230+
"org.apache.commons.lang3.text;WordUtils;false;capitalize;(java.lang.String,char[]);;Argument[0];ReturnValue;taint",
231+
"org.apache.commons.lang3.text;WordUtils;false;initials;(java.lang.String);;Argument;ReturnValue;taint",
232+
"org.apache.commons.lang3.text;WordUtils;false;initials;(java.lang.String,char[]);;Argument[0];ReturnValue;taint",
233+
"org.apache.commons.lang3.text;WordUtils;false;capitalizeFully;(java.lang.String);;Argument;ReturnValue;taint",
234+
"org.apache.commons.lang3.text;WordUtils;false;capitalizeFully;(java.lang.String,char[]);;Argument[0];ReturnValue;taint",
235+
"org.apache.commons.text;WordUtils;false;wrap;;;Argument[0];ReturnValue;taint",
236+
"org.apache.commons.text;WordUtils;false;wrap;(java.lang.String,int,java.lang.String,boolean);;Argument[2];ReturnValue;taint",
237+
"org.apache.commons.text;WordUtils;false;wrap;(java.lang.String,int,java.lang.String,boolean,java.lang.String);;Argument[2];ReturnValue;taint",
238+
"org.apache.commons.text;WordUtils;false;uncapitalize;(java.lang.String);;Argument;ReturnValue;taint",
239+
"org.apache.commons.text;WordUtils;false;uncapitalize;(java.lang.String,char[]);;Argument[0];ReturnValue;taint",
240+
"org.apache.commons.text;WordUtils;false;swapCase;;;Argument;ReturnValue;taint",
241+
"org.apache.commons.text;WordUtils;false;capitalize;(java.lang.String);;Argument;ReturnValue;taint",
242+
"org.apache.commons.text;WordUtils;false;capitalize;(java.lang.String,char[]);;Argument[0];ReturnValue;taint",
243+
"org.apache.commons.text;WordUtils;false;abbreviate;;;Argument[0];ReturnValue;taint",
244+
"org.apache.commons.text;WordUtils;false;abbreviate;;;Argument[3];ReturnValue;taint",
245+
"org.apache.commons.text;WordUtils;false;initials;(java.lang.String);;Argument;ReturnValue;taint",
246+
"org.apache.commons.text;WordUtils;false;initials;(java.lang.String,char[]);;Argument[0];ReturnValue;taint",
247+
"org.apache.commons.text;WordUtils;false;capitalizeFully;(java.lang.String);;Argument;ReturnValue;taint",
248+
"org.apache.commons.text;WordUtils;false;capitalizeFully;(java.lang.String,char[]);;Argument[0];ReturnValue;taint"
264249
]
265250
}
266-
267-
override predicate returnsTaintFrom(int arg) { arg = -1 }
268-
}
269-
270-
private class ApacheStrLookup extends RefType {
271-
ApacheStrLookup() {
272-
this.hasQualifiedName("org.apache.commons.lang3.text", "StrLookup") or
273-
this.hasQualifiedName("org.apache.commons.text.lookup", "StringLookup")
274-
}
275-
}
276-
277-
private class ApacheStringLookupFactory extends RefType {
278-
ApacheStringLookupFactory() {
279-
this.hasQualifiedName("org.apache.commons.text.lookup", "StringLookupFactory")
280-
}
281251
}
282252

283253
/**
284-
* A callable that constructs an Apache Commons `Str[ing]Lookup` from a map.
254+
* Taint-propagating models for `StrTokenizer`.
285255
*/
286-
private class ApacheStrLookupTaintingMethod extends TaintPreservingCallable {
287-
ApacheStrLookupTaintingMethod() {
288-
this.getSourceDeclaration().getDeclaringType() instanceof ApacheStrLookup and
289-
this.getName() = "mapLookup"
290-
or
291-
this.getDeclaringType() instanceof ApacheStringLookupFactory and
292-
this.getName() = "mapStringLookup"
293-
}
294-
295-
override predicate returnsTaintFrom(int arg) { arg = 0 }
296-
}
297-
298-
/**
299-
* A callable that looks up a value in a Apache Commons `Str[ing]Lookup` map.
300-
*/
301-
private class ApacheStrLookupTaintGetter extends TaintPreservingCallable {
302-
ApacheStrLookupTaintGetter() {
303-
this.getSourceDeclaration().getDeclaringType() instanceof ApacheStrLookup and
304-
this.getName() = "lookup"
305-
}
306-
307-
override predicate returnsTaintFrom(int arg) { arg = -1 }
308-
}
309-
310-
private class ApacheStrSubstitutor extends RefType {
311-
ApacheStrSubstitutor() {
312-
this.hasQualifiedName("org.apache.commons.lang3.text", "StrSubstitutor") or
313-
this.hasQualifiedName("org.apache.commons.text", "StringSubstitutor")
256+
private class ApacheStrTokenizerModel extends SummaryModelCsv {
257+
override predicate row(string row) {
258+
row =
259+
[
260+
"org.apache.commons.lang3.text;StrTokenizer;false;StrTokenizer;;;Argument[0];ReturnValue;taint",
261+
"org.apache.commons.lang3.text;StrTokenizer;false;clone;;;Argument[-1];ReturnValue;taint",
262+
"org.apache.commons.lang3.text;StrTokenizer;false;toString;;;Argument[-1];ReturnValue;taint",
263+
"org.apache.commons.lang3.text;StrTokenizer;false;reset;;;Argument;ReturnValue;taint",
264+
"org.apache.commons.lang3.text;StrTokenizer;false;reset;;;Argument;Argument[-1];taint",
265+
"org.apache.commons.lang3.text;StrTokenizer;false;next;;;Argument[-1];ReturnValue;taint",
266+
"org.apache.commons.lang3.text;StrTokenizer;false;getContent;;;Argument[-1];ReturnValue;taint",
267+
"org.apache.commons.lang3.text;StrTokenizer;false;previous;;;Argument[-1];ReturnValue;taint",
268+
"org.apache.commons.lang3.text;StrTokenizer;false;getTokenList;;;Argument[-1];ReturnValue;taint",
269+
"org.apache.commons.lang3.text;StrTokenizer;false;getTokenArray;;;Argument[-1];ReturnValue;taint",
270+
"org.apache.commons.lang3.text;StrTokenizer;false;previousToken;;;Argument[-1];ReturnValue;taint",
271+
"org.apache.commons.lang3.text;StrTokenizer;false;nextToken;;;Argument[-1];ReturnValue;taint",
272+
"org.apache.commons.lang3.text;StrTokenizer;false;getTSVInstance;;;Argument;ReturnValue;taint",
273+
"org.apache.commons.lang3.text;StrTokenizer;false;getCSVInstance;;;Argument;ReturnValue;taint",
274+
"org.apache.commons.text;StrTokenizer;false;StrTokenizer;;;Argument[0];ReturnValue;taint",
275+
"org.apache.commons.text;StrTokenizer;false;clone;;;Argument[-1];ReturnValue;taint",
276+
"org.apache.commons.text;StrTokenizer;false;toString;;;Argument[-1];ReturnValue;taint",
277+
"org.apache.commons.text;StrTokenizer;false;reset;;;Argument;ReturnValue;taint",
278+
"org.apache.commons.text;StrTokenizer;false;reset;;;Argument;Argument[-1];taint",
279+
"org.apache.commons.text;StrTokenizer;false;next;;;Argument[-1];ReturnValue;taint",
280+
"org.apache.commons.text;StrTokenizer;false;getContent;;;Argument[-1];ReturnValue;taint",
281+
"org.apache.commons.text;StrTokenizer;false;previous;;;Argument[-1];ReturnValue;taint",
282+
"org.apache.commons.text;StrTokenizer;false;getTokenList;;;Argument[-1];ReturnValue;taint",
283+
"org.apache.commons.text;StrTokenizer;false;getTokenArray;;;Argument[-1];ReturnValue;taint",
284+
"org.apache.commons.text;StrTokenizer;false;previousToken;;;Argument[-1];ReturnValue;taint",
285+
"org.apache.commons.text;StrTokenizer;false;nextToken;;;Argument[-1];ReturnValue;taint",
286+
"org.apache.commons.text;StrTokenizer;false;getTSVInstance;;;Argument;ReturnValue;taint",
287+
"org.apache.commons.text;StrTokenizer;false;getCSVInstance;;;Argument;ReturnValue;taint",
288+
"org.apache.commons.text;StringTokenizer;false;StringTokenizer;;;Argument[0];ReturnValue;taint",
289+
"org.apache.commons.text;StringTokenizer;false;clone;;;Argument[-1];ReturnValue;taint",
290+
"org.apache.commons.text;StringTokenizer;false;toString;;;Argument[-1];ReturnValue;taint",
291+
"org.apache.commons.text;StringTokenizer;false;reset;;;Argument;ReturnValue;taint",
292+
"org.apache.commons.text;StringTokenizer;false;reset;;;Argument;Argument[-1];taint",
293+
"org.apache.commons.text;StringTokenizer;false;next;;;Argument[-1];ReturnValue;taint",
294+
"org.apache.commons.text;StringTokenizer;false;getContent;;;Argument[-1];ReturnValue;taint",
295+
"org.apache.commons.text;StringTokenizer;false;previous;;;Argument[-1];ReturnValue;taint",
296+
"org.apache.commons.text;StringTokenizer;false;getTokenList;;;Argument[-1];ReturnValue;taint",
297+
"org.apache.commons.text;StringTokenizer;false;getTokenArray;;;Argument[-1];ReturnValue;taint",
298+
"org.apache.commons.text;StringTokenizer;false;previousToken;;;Argument[-1];ReturnValue;taint",
299+
"org.apache.commons.text;StringTokenizer;false;nextToken;;;Argument[-1];ReturnValue;taint",
300+
"org.apache.commons.text;StringTokenizer;false;getTSVInstance;;;Argument;ReturnValue;taint",
301+
"org.apache.commons.text;StringTokenizer;false;getCSVInstance;;;Argument;ReturnValue;taint"
302+
]
314303
}
315304
}
316305

317306
/**
318-
* A callable declared on Apache Commons `StrSubstitutor` that returns taint.
307+
* Taint-propagating models for `StrLookup`.
319308
*/
320-
private class ApacheStrSubstitutorTaintGetter extends TaintPreservingCallable {
321-
ApacheStrSubstitutorTaintGetter() {
322-
this.getSourceDeclaration().getDeclaringType() instanceof ApacheStrSubstitutor and
323-
(
324-
this instanceof Constructor or
325-
this.getName() = "replace"
326-
)
327-
}
328-
329-
override predicate returnsTaintFrom(int arg) {
330-
arg in [0, -1]
331-
or
332-
this.isStatic() and arg = 1
309+
private class ApacheStrLookupModel extends SummaryModelCsv {
310+
override predicate row(string row) {
311+
row =
312+
[
313+
"org.apache.commons.lang3.text;StrLookup;false;lookup;;;Argument[-1];ReturnValue;taint",
314+
"org.apache.commons.lang3.text;StrLookup;false;mapLookup;;;Argument;ReturnValue;taint",
315+
"org.apache.commons.text.lookup;StringLookup;true;lookup;;;Argument[-1];ReturnValue;taint",
316+
"org.apache.commons.text.lookup;StringLookupFactory;false;mapStringLookup;;;Argument;ReturnValue;taint"
317+
]
333318
}
334319
}
335320

336321
/**
337-
* A callable declared on Apache Commons `StrSubstitutor` that transfers taint.
322+
* Taint-propagating models for `StrSubstitutor`.
338323
*/
339-
private class ApacheStrSubstitutorTaintTransfer extends TaintPreservingCallable {
340-
ApacheStrSubstitutorTaintTransfer() {
341-
this.getSourceDeclaration().getDeclaringType() instanceof ApacheStrSubstitutor and
342-
this.getName() in ["replaceIn", "setVariableResolver"]
343-
}
344-
345-
override predicate transfersTaint(int src, int sink) {
346-
if this.getName() = "replaceIn" then (src = -1 and sink = 0) else (src = 0 and sink = -1)
324+
private class ApacheStrSubstitutorModel extends SummaryModelCsv {
325+
override predicate row(string row) {
326+
row =
327+
[
328+
"org.apache.commons.lang3.text;StrSubstitutor;false;StrSubstitutor;;;Argument[0];ReturnValue;taint",
329+
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;;;Argument[-1];ReturnValue;taint",
330+
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object);;Argument;ReturnValue;taint",
331+
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(char[]);;Argument;ReturnValue;taint",
332+
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(char[],int,int);;Argument[0];ReturnValue;taint",
333+
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.CharSequence);;Argument;ReturnValue;taint",
334+
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.CharSequence,int,int);;Argument[0];ReturnValue;taint",
335+
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.String);;Argument;ReturnValue;taint",
336+
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(org.apache.commons.lang3.text.StrBuilder);;Argument;ReturnValue;taint",
337+
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.StringBuffer);;Argument;ReturnValue;taint",
338+
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.StringBuffer,int,int);;Argument[0];ReturnValue;taint",
339+
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.String,int,int);;Argument[0];ReturnValue;taint",
340+
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(org.apache.commons.lang3.text.StrBuilder,int,int);;Argument[0];ReturnValue;taint",
341+
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object,java.util.Map);;Argument;ReturnValue;taint",
342+
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object,java.util.Map,java.lang.String,java.lang.String);;Argument[0];ReturnValue;taint",
343+
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object,java.util.Map,java.lang.String,java.lang.String);;Argument[1];ReturnValue;taint",
344+
"org.apache.commons.lang3.text;StrSubstitutor;false;replace;(java.lang.Object,java.util.Properties);;Argument;ReturnValue;taint",
345+
"org.apache.commons.lang3.text;StrSubstitutor;false;setVariableResolver;;;Argument;Argument[-1];taint",
346+
"org.apache.commons.lang3.text;StrSubstitutor;false;replaceIn;(org.apache.commons.lang3.text.StrBuilder);;Argument[-1];Argument;taint",
347+
"org.apache.commons.lang3.text;StrSubstitutor;false;replaceIn;(java.lang.StringBuffer);;Argument[-1];Argument;taint",
348+
"org.apache.commons.lang3.text;StrSubstitutor;false;replaceIn;(java.lang.StringBuffer,int,int);;Argument[-1];Argument[0];taint",
349+
"org.apache.commons.lang3.text;StrSubstitutor;false;replaceIn;(java.lang.StringBuilder);;Argument[-1];Argument;taint",
350+
"org.apache.commons.lang3.text;StrSubstitutor;false;replaceIn;(java.lang.StringBuilder,int,int);;Argument[-1];Argument[0];taint",
351+
"org.apache.commons.lang3.text;StrSubstitutor;false;replaceIn;(org.apache.commons.lang3.text.StrBuilder,int,int);;Argument[-1];Argument[0];taint",
352+
"org.apache.commons.text;StringSubstitutor;false;StringSubstitutor;;;Argument[0];ReturnValue;taint",
353+
"org.apache.commons.text;StringSubstitutor;false;replace;;;Argument[-1];ReturnValue;taint",
354+
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object);;Argument;ReturnValue;taint",
355+
"org.apache.commons.text;StringSubstitutor;false;replace;(char[]);;Argument;ReturnValue;taint",
356+
"org.apache.commons.text;StringSubstitutor;false;replace;(char[],int,int);;Argument[0];ReturnValue;taint",
357+
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.CharSequence);;Argument;ReturnValue;taint",
358+
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.CharSequence,int,int);;Argument[0];ReturnValue;taint",
359+
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.String);;Argument;ReturnValue;taint",
360+
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.StringBuffer);;Argument;ReturnValue;taint",
361+
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.StringBuffer,int,int);;Argument[0];ReturnValue;taint",
362+
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.String,int,int);;Argument[0];ReturnValue;taint",
363+
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object,java.util.Map);;Argument;ReturnValue;taint",
364+
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object,java.util.Map,java.lang.String,java.lang.String);;Argument[0];ReturnValue;taint",
365+
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object,java.util.Map,java.lang.String,java.lang.String);;Argument[1];ReturnValue;taint",
366+
"org.apache.commons.text;StringSubstitutor;false;replace;(java.lang.Object,java.util.Properties);;Argument;ReturnValue;taint",
367+
"org.apache.commons.text;StringSubstitutor;false;replace;(org.apache.commons.text.TextStringBuilder);;Argument;ReturnValue;taint",
368+
"org.apache.commons.text;StringSubstitutor;false;replace;(org.apache.commons.text.TextStringBuilder,int,int);;Argument[0];ReturnValue;taint",
369+
"org.apache.commons.text;StringSubstitutor;false;setVariableResolver;;;Argument;Argument[-1];taint",
370+
"org.apache.commons.text;StringSubstitutor;false;replaceIn;(java.lang.StringBuffer);;Argument[-1];Argument;taint",
371+
"org.apache.commons.text;StringSubstitutor;false;replaceIn;(java.lang.StringBuffer,int,int);;Argument[-1];Argument[0];taint",
372+
"org.apache.commons.text;StringSubstitutor;false;replaceIn;(java.lang.StringBuilder);;Argument[-1];Argument;taint",
373+
"org.apache.commons.text;StringSubstitutor;false;replaceIn;(java.lang.StringBuilder,int,int);;Argument[-1];Argument[0];taint",
374+
"org.apache.commons.text;StringSubstitutor;false;replaceIn;(org.apache.commons.text.TextStringBuilder);;Argument[-1];Argument;taint",
375+
"org.apache.commons.text;StringSubstitutor;false;replaceIn;(org.apache.commons.text.TextStringBuilder,int,int);;Argument[-1];Argument[0];taint"
376+
]
347377
}
348378
}

0 commit comments

Comments
 (0)